# A borrower eligible for liquidation can pay an improperly large amount of fees, and may be unfairly liquidated

Partial emergency liquidation in LiquidityBorrowingManager doesn't update accLoanRatePerSeconds, so a borrower who re-adds collateral pays double fees and can be unfairly liquidated.

- Payout: Contest reward
- Severity: medium
- Program: Leverage Contracts
- Credited: 0xDetermination
- Disclosed: 2024-02-22
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2024-02-leverage-contracts-judging/issues/40
- Library page: https://bugbountylibrary.com/r/sherlock%3A2024-02-leverage-contracts%3AM-2
- Tags: domain:web3 impact:funds-loss impact:integrity kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:regression technique:source-review vuln:business-logic vuln:liquidation

**Target:** LiquidityBorrowingManager.sol repay()/increaseCollateralBalance()
**Root cause:** Partial emergency liquidation zeroes dailyRateCollateralBalance and collects nearly all fees but never updates accLoanRatePerSeconds, so subsequent fee accrual is computed against stale rate state.
**Steps:**
1. Borrow with collateral; advance time past estimatedLifeTime so collateralBalance goes negative (`-181748761574072227`).
2. Call `repay()` with `isEmergency: true` as a lender; partial liquidation collects nearly all fees and sets dailyRateCollateralBalance to 0.
3. Observe collateralBalance after liquidation is still hugely negative (`-18111392620173611109770`) instead of near zero.
4. Borrower calls `increaseCollateralBalance(borrowingKey, 18000n, deadline)` to restore solvency.
5. Call `repay()` again; position still liquidates because stale accLoanRatePerSeconds makes computed collateralBalance far lower than actual, and fees are double-charged.
**How found:** Code review of repay() fee path: noticed partial emergency liquidation sets dailyRateCollateralBalance to zero and collects entire collateral as fees but does not update accLoanRatePerSeconds; wrote a modified test with console.logs to confirm collateralBalance stayed large negative after liquidation and that increasing collateral still allowed liquidation.
**Exploitation:** Lender triggers emergency liquidation right after position becomes liquidatable, collecting essentially all fees; borrower's attempt to recapitalize is defeated because fee accounting uses stale accLoanRatePerSeconds, causing unfair liquidation and loss of collateral.
**Insight:** When a liquidation path zeroes a per-position accumulator (dailyRateCollateralBalance) but leaves the rate accumulator (accLoanRatePerSeconds) untouched, fee math on the next interaction uses inconsistent state; test post-liquidation state by logging collateralBalance before and after increaseCollateralBalance.